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00 , Abstract 

For stegoschemes arising from error correcting codes, embedding de- 
pends on a decoding map for the corresponding code. As decoding maps 
are usually not complete, embedding can fail. We propose a method 
^ ■ to ensure or increase the probability of embedding success for these 

O ' stegoschemes. This method is based on puncturing codes. We show how 

the use of punctured codes may also increase the embedding efficiency of 
the obtained stegoschemes. 

> ' 

1 Introduction 

O' 

■ Steganography is the art of transmitting information in secret, so that even the 

| existence of communication is hidden. It is realized by embedding the messages 

to be protected into innocuous cover objects such as digital images. In order 
C*~) ' to minimize the possibility of being detected by third parties, the number of 

embedding changes in the cover must be small enough. Consequently, to obtain 
a high payload, steganographers should design stegosystems able to embed as 
much information as possible per cover change. In other words, we seek for 
embedding methods giving high embedding efficiency 



Given a cover image and a secret message, we first select the placement 
and intensity of allowed embedding changes in the cover. This is done by 
means of a selection rule. After this step the cover is transformed into a finite 
sequence X\,...,x n of symbols from an alphabet A (usually A = F 2 ). We refer 
to this sequence as the cover vector x = (x\, . . . , x n ). The secret message will 
be also a vector m = (m 1; . . . ,m r ) G A r . The algorithms used for embedding 
the information m into x and later recovering m from Emb(x, m))form the 
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stegoscheme associated to the stegosystem. 

Crandall first noted that error correcting codes can be used to construct 
stegoschemes of high embedding efficiency. From this discovering many 
stegoschemes have been proposed using different types of codes. Relations 
between codes and stegoschemes will be treated in more detail in Section 
[2l In general, in code based steganography (also called matrix embedding), 
given a code C (or a family of such codes, as explained below), the embedding 
is realized by using a decoding map of C. It turns out that every decoding 
map of C provides a realization of it as a stegoscheme. This nice idea 
encountered in practice a serious problem: the absence of effective complete 
decoding methods. Indeed, for nearly all currently known decoding algorithms, 
most errors are impossible to decode, which means that when using these 
algorithms, the majority of times the embedding process fails. In contrast, 
complete decoding algorithms, for which this problem does not occur, are 
computationally infeasible, so their practical applications are reduced to ei- 
ther perfect codes or codes of small length, which offer low embedding efficiency. 

In this paper we propose a novel method to ensure embedding success, in 
principle for using any code. It is based on puncturing the original code as 
many times as necessary to get a new code whose covering radius equals to the 
correction capability of the original one. As we shall see, this method may also 
improve the embedding efficiency so that it guaranties embedding success and 
may give high embedding efficiency. 

The organization of the paper is as follows. In Section [2] we recall the con- 
nection between coding theory and steganography, as well as we point the above 
mentioned drawback of stegoschemes obtained by this method, concerning de- 
coding maps. Our method is exposed in detail in Section 3. Finally Section 4 
deals to the parameters of the new stegoschemes. Some numerical experiments 
concerning BCH codes are reported. 

2 From coding theory to steganography 

2.1 Stegoschemes and codes 

Let A be a finite alphabet with q elements and let n > r be two positive integers. 
The purpose of a stegoscheme S is to embed a message m G A r into a cover 
vector x 6 A n , making as few changes as possible in x, and later extract the 
information hidden in the modified vector. Formally, a (n, r)-stegoscheme iS is 
defined as a couple of functions S — (Emb, Ext) 

Emb : A n x A r — > A n and Ext : A n — > A r , 

such that Ext(Emb(x, m)) = m, for all (x, m) 6 A n x A r . This condition 
guarantees that we always retrieve the right message m from the stego vector 



2 



Emb(x, m). The stegoscheme is called proper if d(x, Emb(x, m)) < d(x, v) for 
all v such that Ext(v) = m, where d stands for the Hamming distance. This 
means that the number of embedding changes is the minimum possible allowed 
by the extracting map. 

The first stegoscheme based on coding theory was proposed by Crandall in 
1998, by using the family of binary Hamming codes, see [CraSS- Let m be a 
positive integer and let H be a parity check matrix of the binary Hamming code 
of length n = 2 m — 1 . The embedding and extracting functions are as follows 

Emb : Fg x F™ — > Fg 

(x, m) i — > x — cl(xiJ T — m), 

Ext : F™ — > F™ 

where cl(z) stands for a coset leader of z G F™. That is an element of minimum 
Hamming weight among those v G F£ verifying vH l = z. The fact that 
Ext(Emb(x, m)) = m is straightforward. 

This stegoscheme is so efficient that Wcstfcld developed the famous software 
F5 based on it [Wes OlJ. The notion of efficiency, which is the main subject 
of this paper, will be detailed in Section 12.21 After Crandall's discovery, other 
authors proposed the same model of stegoscheme, based on different types 
of codes: BCH |SW06llZSK09] . Reed-Solomon [FG09] . trellis codes [FJFlOj . etc. 

More generally, in [MB 11] it is shown that a (n, r)-stegoscheme is equivalent 
to a family {(C m , dec m )} mS _ /lr where the C m 's are nonempty disjoint codes in 
A n (not necessarily linear), dec m is a decoding map for C m and UC m = A' 1 . 
Let us remember that a decoding map for a code C C A n is just a map dec : 
X C A n — > C. If X = A n then the decoding is said to be complete (as 
every received vector can be decoded). If dec verifies the additional property 
that d(x, dec(x)) = (i(x, C) for all x G X, then dec is called minimum distance 
decoding. Given such a family, the corresponding stegoscheme has embedding 
and extracting functions 

Emb(x, m) = dec m (x) and Ext(v) = m if v G C m . 

If dec is a minimum distance decoding, then the obtained stegoscheme is 
proper. This method allows us to construct a large amount of stegoschemes, to 
which we collectively refer as code-based stegoschemes. If A is a field, A = ¥ q , 
and Co is [n, n — r] linear, it is natural to consider the partition of F™ given by 
the translates of Co (or equivalently, the cosets of F™/Co). Note that given a 
decoding map deco of Co, the function dec m (x) = cl(m) + deco(x — cl(m)) is 
a decoding map for the translate C m = cl(m) + Co- By using the systematic 
writing of Co, say in the first n — r positions, we can avoid the need of 
computing coset leaders in the embedding process (unless they are required 



3 



by deco), as Emb(x, m) = (0,m) + deco(x — (0, m)), see M Bllj . The same 
idea can be applied if Co is a group (nonlinear) code or a general systematic code. 

Therefore, given a linear code C, each decoding map of C provides a realiza- 
tion of C as stegoscheme. Recall that there is a universal decoding method for 
linear codes, the so-called syndrome-leader decoding, based on pre-computing all 
syndromes and leaders. For example, Crandall's stegoscheme is obtained from 
Hamming codes by using syndrome-leader decoding. 

2.2 Embedding Efficiency 

The behavior of a stegoscheme, and subsequently the comparison of two of them, 
is based on its parameters. Let S be a (n, r)-stegoscheme which embeds a mes- 
sage of A r in a vector of A n with T modifications at most and T modifications 
in average. The relative payload, change rate and average change rate of S are 
respectively defined as 

r T ~ f 

a = — , R = — and R = — . 

n n n 

The embedding efficiency and average embedding efficiency of S are defined as 

r r 
e = — and e = — . 
T T 

Recall that when S is arising from a linear or systematic code C (by the method 
above explained), then r is the redundancy of C, and T, T are the covering and 
average radii of C, sec for example [MB 11 . 

Let Si and 52 be two stegoschemes defined over the same alphabet A. If 
they have the same relative payload, then both embed as much information by 
using the same quantity of cover-medium. Thus Si is better than 52 if and only 
if it produces less distortion in the cover, that is, if and only if the embedding 
efficiency of Si is greater than the embedding efficiency of 1S2 ■ So we look for 
stegoschemes with the biggest embedding efficiency for a fixed relative payload. 
There exists an upper on the embedding efficiency for a fixed relative payload 
as follows. 

Theorem 1. Let S be a q-ary stegoscheme with relative payload a and embed- 
ding efficiency e. Then 

a 

e < , 

- H^( a y 

where TL' 1 is the inverse function of the q-ary entropy H q (x) — x\og q (q — 1) — 
xlog q (x) - (1 -x)log,(l -x). 

See jCMB+08l Ch. 12, page 454]. The same result holds asymptotically for 
the average embedding efficiency. 
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2.3 Realizations of codes as stegoschemes 

Let C be a [n, k] linear code over A = ¥ q . As seen in the previous section, 
each decoding map dec of C provides a realization of C as a (n, r) stegoscheme, 
<Sdcc- All of them are different although they share the same theoretical pa- 
rameters: r = n — k is the redundancy of C, R is the covering radius of C 
and R is the average radius of C. This method of making stegoschemes has, in 
practice, a serious difficulty: the dramatic absence of computationally efficient 
complete decoding maps for a given code. As already mentioned above, there is 
a universal complete decoding method for linear codes, namely syndrome-leader 
decoding. For binary codes we can also use gradient decoding, based on mini- 
mal codewords. However, these two methods require the use (computation and 
storage) of tables, usually of a very large size, so they have mainly a theoretical 
interest, being their practical applications restricted to the case of perfect codes 
or codes of small length n. Note that stegoschemes of high efficiency have large 
n. Algebraic decoding methods (not based on using tables) may be computa- 
tionally efficient, but they are far to be complete; usually they decode up to 
the packing radius t = \_(d — 1)/2J, where d is the minimum distance, or even 
less. For example, Berlekamp-Massey algorithm for decoding for BCH codes, 
decodes errors of weight up to one half of the designed minimum distance. For 
BCH two-error correcting codes (which are quasi-perfect) a complete decoding 
method is available in |Har71] by using small tables and these codes have been 
proposed as good candidates for stegoschemes, see [ZSK09] , For other codes 
most vectors cannot be decoded. Consequently, most vectors of A n cannot be 
used as a cover vectors for embedding. Remark that when using codes for error- 
correction, error patterns of low weight are more probable while for embedding 
purposes all vectors are, in principle, equally likely as covers. 

Example 1. Let C = BCH m (3) be the primitive binary triple error correcting 
BCH code of length n — 2 m — 1. Suppose first we want to decode C by using 
syndrome-leader decoding. To that end we need a table containing all syndromes 
and leaders. Since the total number of cosets is 2 3 ™ 1 = (n + 1) 3 ; the size of this 
table, in megabits, is the given in the following Table 1. 



m 


size in Mb 


5 


1.507 


6 


21.234 


7 


310.378 


8 


4680.843 


9 


72209.138 


10 


1130650.141 



Table 1: Size of a syndrome-leader table for the code BCH m (3). 

It is clear that we need other decoding methods even for small values of to. 
Let us consider the minimum distance decoding map dec obtained by means of 



5 



Berlekamp-Massey algorithm. It corrects up to 3 errors. Since the covering 
radius of this code is 5, see \Hel7£>l , error patterns of weight < 5 can occur. Let 
Aj denote the number of cosets having leaders of weight j . Since every vector 
of weight < 3 is a coset leader and there are 2 3m = (n + l) 3 cosets, then the 
number of cosets whose vectors cannot be decoded by dec is 

a a , «\<\ f n\ n(n + l)(5n + 13) 



Since the leading coefficient of the numerator is 5, asymptotically 5/6 of error 
patterns cannot be decoded. Consequently, the stegoscheme based on C m and 
dec, successfully embeds a message into a random cover vector with probability 
close to 1/6. Let us note, however, that it is known a computationally efficient 
decoding algorithm for C, see \VDEBiej . In fact BCH(2) and BCH(3) are the 
only codes in the family of BCH codes for which such a complete decoding is 
available. 

Given a (n, r) stegoscheme S = (Emb, Ext), the previous considerations 
allow us to define the embedding probability p$ of iS as the probability that 
Emb(x, m) can be computed over all possible pairs (x, m) £ A n X A r (considered 
as equally likely). We define also the embedding efficiency of S relative to the 
embedding probability ps (resp. average embedding efficiency of S relative to the 
embedding probability) as 

e re i = e.ps and e rd = e.p s . 

Example 2. (Example^ continued). Let S be the stegoscheme obtained from 
C = BCH. m (3). The parameters of S can be obtained from the parameters of 
C. In particular, n — 2 m — 1, r = 3m (the redundancy of C) and T — 5 (the 
covering radius ofC). In the same way, we can obtain the average change rate 
T of S as the average radius ofC, 

5 

f = 2- 3m ^2jAj. 

3=0 

Since the values of A 4 and A§ are not known in general, we can not compute 
exactly this number. However, we have the following bounds [VDHB76I 

5n(5n + 13) < < n(5n 2 + lOn - 3) 
6 " 4 " (3 ' 

An(n + 2) n(n ~ 4)(5n + 13) 

3 ~ 5 " (S ' 

The embedding probability can be deduced from our computations in Example^ 
as 

ps = 2 ^j2 f " ^ ' 

j=o 

The following Table 2 collects the efficiency and relative efficiency of these 
stegoschemes for some small values of m. 
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m 


n 


r 


f 


e 


e 


Ps 


&rel 




4 


15 


10 


3.33 


2 


3.003 


0.141 


0.281 


0.422 


5 


31 


15 


4.28 


3 


3.504 


0.152 


0.457 


0.532 


6 


63 


18 


4.06 


3.6 


4.433 


0.159 


0.573 


0.704 


7 


127 


21 


3.85 


4.2 


5.454 


0.162 


0.684 


0.883 


8 


255 


24 


3.84 


4.8 


6.250 


0.163 


0.791 


0.891 


9 


511 


27 


3.84 


5.4 


7.031 


0.166 


0.896 


1.167 


10 


1023 


30 


3.84 


6 


7.812 


0.166 


0.996 


1.296 



Table 2: Embedding efficiency of stegoschemes based on BCH m (3) codes. 

3 A method to ensure embedding success 

As we highlighted in the previous section, it is important to have a stegoschcme 
with an embedding probability as close to one as possible. In this section, we 
propose to modify the stegoscheme arising from a given code in order to ensure 
success (or at least to improve its probability). 

3.1 Puncturing codes 

Let C be a [n, n — r,d] code of covering radius p. Let dec be a decoding map of C, 
which can decode up to t errors. The main idea of our method is to imitate, in 
a sense, the behavior of perfect codes. To that end, we will puncture C as many 
times as necessary to obtain a code C with covering radius p' — t. Then we can 
use dec to deduce a decoding map for C, as explained in the next paragraph. 
Let us remember that given a code C, puncturing C at a position i is to delete 
the i-th coordinate in each codeword. If G is a generator matrix for C, then a 
generator matrix for the punctured code is obtained from G by deleting column 
i (and dependent rows if necessary), see (HP031 Sect. 1.5.1]. 

3.2 Decoding punctured codes 

Let C be a binary linear code and C be the code obtained from C by puncturing 
at a set of positions V C {1, ...,n}. Let V = {1, . . . , n} \ V, be the 
projection on the coordinates of V and dec a decoding map for C. The following 
algorithm provides a decoding map for C. 

Proposition 1. The algorithm[J\is correct and runs in 0(q^^c^ ec ), where a C c 
is the complexity of dec the decoding map ofC. 

Proof. Let y' G ¥q ' 7? ' and c' G C be a codeword such that <i(y',c') < t. Then 
there exist c G C such that 7Tp(c) = c'. Let us to note that y G F™ such that 
7r-p(y) = 7pp(c) and 7Tp(y) = y'. Then c' is in the returned list. The statement 
of the complexity is obvious. □ 
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Algorithm 1: Decoding algorithm for the punctured code C. 

Input : The punctured set V, the received vector y' G Fq and the 

decoding map dec of C. 
Output: The list of all codewords c' of C such that d(c',y') < t. 

ti- 
ll for q 1^1 elements 

foreach F™ such that 7Tp(y) = j/ do 

C <- £Udec(y); 
end 

return {^(c) : c G £} 



If dec corrects up to t errors, the previous algorithm provides a decoding 
map for C correcting t errors as well: as the returned list is nonempty, simply 
take one of the vectors closest to y'. 

Note that the statement about complexity in Proposition [T] has been com- 
puted considering the worst case. In following, we propose a little improvement 
for the average case. 

Let y' G Fq~'' P ', y' C , be the vector to be decoded and let c' G C be the 
closest codeword of y'. Then d(c',y') = d(C',y'). Let e' G F^' 73 ' be such that 
y = c + e , hence wt(e') < p = t. There exists a "prefix" vector pgF, such 
that c = (p, c') G C, with 7pp(c) = p and 7ip-(c) = c'. Finally, let y, e G F™ such 
that y = (p, y') = c + e. As stated before, Algorithm 1 works by considering 
all possible prefixes. However, since e = (0,e'), and hence wt(e) = wt(e'), this 
algorithm can be slightly changed to avoid unnecessary iterations. In fact, the 
minimum number of iterations depends on wt(e'). It is simple to see that the 
number of iterations needed to decode is 



V q (\V\,t-wt(e')) 

Furthermore, all this iterations should be parallelized to speed up the algorithm. 
Of course, the value wt(e') is not known a priori, but for each codeword c, G C, 
then distance d(ci,y) gives an upper bound to the distance between y and the 
closest codeword c. 

Example 3. (Continued from previous examples). Consider the code BCH^{i) 
of parameters [15,5]. Here t — 3 and, as we can see in Tabled we get \V\ = 3. 

Let C be the binary BCH^{i) code, V — {1,2,3} be a punctured set and C 
be the punctured code of C at the position given by V . We propose to decode 
on C , y 1 = (1,1,1,1,1,1,1,1,1,0,0,0) the received word. We obtain C\ = 
(1,0,0,1,1,0,1,0,1,1,1,1,0,0,0) by the decoding of y l . We deduce that c[ = 
np(ci) = (1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0) is a codeword of C . Since d(c[, y') = 2, 
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(0, 0, 0) 



(0, 0, 1) 
(0, 1, 0) 
(1, 0, 0) 



(0, 1, 1) 
(1,0, 1) 
(1, 1,0) 



(1, 1, 1) 



Table 3: All binary vectors of length 3 sorted by weights. 



then only 



decoding calls is needed. Let y 2 — (1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0) be the sec- 
ond, and last, virtual received word of C. Note that the prefix used in this case, 
(1, 1, 1), is the farthest from the previous one, that is (0, 0, 0). The decoding on 
C gives us c 2 = (1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1), which allows us to compute 
c' 2 = TTp{c 2 ) = (1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1). Since d(c' 2 , j/) = 3 > d(c[, y 1 ), we 
deduce that the closest codeword is c[ . 

Another way to see our trick on this example, is after the computation of c\, 
we observe that d(c[, y 1 ) = 2, then the closest codeword from y 1 is at most at 
distance 2. Since the decoding algorithm on C can correct 3 errors, there is an 
extra error for the prefix set, see Table\3\ Thus the decoding with prefix (0,0,0) 
manage the prefix vectors of weight and 1. Moreover, the decoding with prefix 
(1,1,1) manage the prefix vectors of weight 2 and 3, so all prefix vectors are 
managed only by these 2 decodings. 

With this trick, we need only 2 decoding processes whereas our previous algo- 
rithm needs 8. 



3.3 On the number of punctured positions 

Since the decoding complexity of the punctured code C is exponential on the 
number of punctured positions, we want to minimize this quantity. To that end 
we introduce some new notation. For a given integer j < p, let 

y 3 - {yei?:d(y,C)>p-j} 

S s = {y-ceI^:yG^ ) ceCandd(y,c) = d(y,C)} 

v j = n su pp( e )- 

ee£j 

Proposition 2. Let j be a positive integer and let be the code obtained by 
puncturing C at the positions of Vj . The covering radius of C'j satisfies 

Pj < max {p-j-l,p - \Vj\} . 

Proof. Assume there exists y' G ¥g '' f ' 3 ' such that d(y',C) > 
max{p- j - l,p- \Vj\}. Let (c',e') e C x F^ 1 "^ such that y' = c' + e' and 
wt(e') = d(y',c') = d(y',C) > max{p-j - l,p - \Vj\}. Then there exist 
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y G yj and (c, e) 6 C x £j such that 7r^ (y) = y' and 

f y = c + e, 

1 Wp/e) = e'. 

Since e e £ 3 , we have Pj C supp(e) and so wt(e) = wt(e') + \Vj\ > p, which is 
impossible by the definition of covering radius. □ 

Therefore, greater j implies smaller p — j — 1 but also greater p — \Pj\. 
For steganographic purposes we must puncture to obtain a code C with a 
covering radius equal to the correction capacity of the decoding map of C. Since 
puncturing n— 1 times leads to a code of covering radius 0, this is always possible. 



Algorithm 2: Algorithm to compute the punctured code C. 
Input : A code C, its covering radius p and a positive integer t. 
Output: A couple (C',V), where C is obtained from C by puncturing at 
the positions of V and has covering radius t. 

(C',p')^(C,p); 

while t ^ p' do 

CL leaders of cosets of C with weight greater than t; 

Wax "S— the position which occurs the most of time in the support of 

CL; 

P^rU {imax}; 

C <— C punctured at the position i max ; 
p' <r- covering radius of C; 
end 

return (C',V) 



The main drawback of this algorithm is that it could be very expensive in 
time and memory complexities, since it requires the computation of the whole 
set of the coset leaders. Note however, that this computation must be done just 
once for code (as for any other parameter of C). 

3.4 A stegoscheme based on a punctured code 

Let C be a code of covering radius p and dec a decoding map correcting t errors. 
Assume we know the set V of positions to obtain C, the punctured code of 
covering radius t, which can be computed by using Algorithm^ Moreover let 
dec' be a decoding map for C obtained from Algorithm [1] Finally, let H' be a 
parity check matrix of C. It can be easily obtained from a generator matrix G 
which, in turn, can be easily obtained from a generator matrix G of C. We have 
all the ingredients to define a stegoscheme S' based on the matrix embedding 
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principle with the punctured code C . Let n' and r' be, respectively, the length 
and redundancy of C . The embedding map of S 1 is 

Emb : Fo' x F"' — > F™' 

z, q q 

(m , v) i — > y + dec(v-y), 

where y is an element of F™ such that yH' T = m. Recall that when C is in 
systematic form, then one can simply take y = (0, m). The extracting map is 

Ext : F™' — > ¥ r 2 ' 

y yH' T . 

It is simple to check that Ext (Emb (m, v)) = m so that couple (Emb, Ext) 
defines a true stegoscheme S' . 



3.5 Tradeoff 

In previous sections we have suggested the use of puncturing up to ensuring 
embedding success. However, since complete decoding is known to be an NP- 
hard problem |BMVT78] . in specific situations this goal may be too ambitious. 

Indeed, we can simply use the puncturation principle to increase the em- 
bedding probability, but not necessarily up to one. For example, the sender 
could have a target embedding probability ps < 1, which is not reachable by 
the original stegoscheme. Then we can stop the puncturation process when the 
target embedding probability is reached. Analogously, since the complexity of 
the decoding algorithm for punctured codes is exponential in the number of 
the punctured positions, the steganographer may also limit this number to a 
preset maximum, according to available computing resources. In short, the pro- 
posed method is totally versatile to be modified according to the requirements 
of the sender. In the rest of this article, we puncture up to have an embedding 
probability ps = 1. 



4 Parameters of the new stegoschemes 

Keeping notations as in the previous section, let C be a code for which there ex- 
ists an efficient algorithm capable of correcting t errors. Let C be its punctured 
of covering radius t, and let S, S' be the stegoschemes obtained from C and C 
respectively. The parameters of S' are 

, r' , t , _ , _ r' ~,_ f' _ r' 

TV TV t TV T' 

where T" is the average covering radius of C. It is not easy to obtain general 
closed formulas for these parameters, since they depend on the number and 
location of punctured positions, which in turn depend on the code C and the 
number t. However, except for perfect codes (for which t is just the covering 
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m 


BCH m (2) 


punctured BCH m (2) 


n 


r 


a 


R 


e 


e 


n' 


r' 


a' 


R' 


e' 


e' 


4 


15 


8 


0.533 


0.164 


2.67 


3.25 


11 


4 


0.363 


1.375 


2 


2.909 


5 


31 


10 


0.323 


0.0801 


3.33 


4.03 


28 


7 


0.250 


1.766 


3.5 


3.965 


6 


63 


12 


0.190 


0.0396 


4 


4.81 


59 


8 


0.135 


1.777 


4 


4.501 


7 


127 


14 


0.110 


0.0197 


4.66 


5.61 


123 


10 


0.081 


1.879 


5 


5.322 


8 


255 


16 


0.0627 


0.0098 


5.34 


6.41 


251 


12 


0.047 


1.939 


6 


6.189 


9 


511 


18 


0.0352 


0.00489 


6 


7.2 


507 


14 


0.027 


1.969 


7 


7.110 


10 


1023 


20 


0.196 


0.00244 


6.66 


8 


1018 


15 


0.014 


1.969 


7.5 


7.617 


11 


2047 


22 


0.0107 


0.00122 


7.34 


8.80 


2042 


17 


0.008 


1.984 


8.5 


8.566 



Table 4: Parameters of stegoschemes arising from binary BCH m (2) codes and 
punctured BCH m (2) codes. 



m 


BCH m (3) 


punctured BCH m (3) 


n 


r 


a 


R 


e 


e 


n 


r 


a' 


R' 


e 


e 


4 


15 


10 


0.667 


0.222 


2 


3 


12 


7 


0.583 


0.191 


2.33 


3.05 


5 


31 


15 


0.484 


0.138 


3 


3.5 


25 


9 


0.36 


0.0985 


3 


3.65 


6 


63 


18 


0.286 


0.0645 


3.6 


4.43 


56 


11 


0.197 


0.0434 


3.67 


4.52 


7 


127 


21 


0.165 


0.0303 


4.2 


5.45 


121 


15 


0.124 


0.0230 


5 


5.38 


8 


255 


24 


0.0941 


0.0151 


4.8 


6.25 


248 


17 


0.0686 


0.0112 


5.66 


6.11 


9 


511 


27 


0.0529 


0.00751 


5.4 


7.03 


504 


20 


0.0397 


0.00572 


6.66 


6.94 



Table 5: Parameters of stegoschemes arising from binary BCH m (3) codes and 
punctured BCH m (3) codes. 

radius of C and we do not need to puncture) we have ps> = 1, n' < n, a > a' and 
T' = t < T, T' < T. The embedding efficiency of S' may be larger or smaller 
than the embedding efficiency of <S, for a relative payload fixed. 

4.1 Numerical experiments 

In order to see some concrete results showing the performance of our method, we 
list some numerical results obtained for primitive two and three error correcting 
binary BCH codes, taking the number t given by the BCH bound (that is, 
allowing efficient decoding by means of Berlekamp-Massey algorithm, as usual). 
These codes have been studied by many authors \ l)HP>7<i Hel78j and proposed 
as good candidates for constructing stegoschemes. It is well known that they 
have covering radii 3 and 5 respectively, and that BCH m (2) is quasi-perfect. By 
using Algorithm^ we have determined the couple (C',V) for some two and three 
error-correcting binary BCH codes and subsequently computed the parameters 
of the corresponding stegoschemes. 

The obtained results are listed in Tables |4] (two-error-correcting, t = 2) 
and [5] (three-error-correcting, t — 3). Notations in these tables are same used 
throughout this article. In both cases we puncture BCH codes to get other 
codes whose covering radii are equal to the correction capabilities of BCH codes. 
Then R = 3, R' = 2 for two-error-correcting and R = 5, R' = 3 for three-error- 
correcting BCH codes. We do not include the probability of embedding success 
for punctured codes, since in all cases such probability is exactly 1. For a better 
understanding of these results, and a comparison with stegoschemes coming 
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Embedding efficiency a lunctioii of relative payload 




Theoretical bound 
BCH 2-corrector 
Punctured BCH 2-corrector 



Figure 1: Comparison between stegoschemes based on the binary BCH m (2) and 
their punctured associated codes. 



Embedding efficiency :^ a 111 net ion of relative payload 




Theoretical bound 
BCH 3-corrector 
Punctured BCH 3-corrector 



Figure 2: Comparison between stegoschemes based on the binary BCH m (3) and 
their punctured associated codes. 
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from original BCH codes, we also include a graphical representation in Figures 
[Hand H 

As we see, the new stegoschemes may have a better performance in terms of 
embedding efficiency. For example, in Table 01 we can see how the stegosystem 
based on BCHg(2) has the same embedding efficiency as the stegoscheme based 
on BCHg(2)', but with a smaller relative payload. Thus we conclude that the 
stegoschemes based on punctured codes may be better than the original ones 
in the worst case, although they do not appear to be better in terms of average 
embedding efficiency. 

All computations have been performed by using the system MAGMA 
[BCP97. , where BCH codes are managed in systematic form. We remark that 
all punctured positions have resulted to be among the first n — r (systematic) 
positions. Given our limited computer resources, we have not used Algorithm[2] 
in full to obtain the puncturing of BCH§(3) and BCHg(3). Instead we have 
punctured these codes just at the first positions, up to obtain a code with cov- 
ering radius R' equal to t = 3 (and then true results may be somewhat better 
than those shown in Table [5]). 



5 Conclusion 

We have proposed a method to ensure or increase the probability of embedding 
success for stegoschemes arising from error correcting codes. This method is 
based on puncturing codes. As we have seen, the use of these punctured codes 
can also increase the embedding efficiency of the obtained stegoschemes. 
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